
<HTML>

<HEAD>

<TITLE>Pick a Safe Password -- a strategy for safe secure computing : wolfram.org</TITLE>

<META name="keywords" content="How, To, Tips, Tricks, tutorials, GPG, PGP, encrypt, encryption, password">

<META name="description" content="Instructions on how to pick a safe password.">

</HEAD>

<BODY style="color:white;background-color:black">

<STRONG><A HREF="/eric/" TITLE="Eric's Biography">Eric Wolfram</A>'s

Writing, How to Pick a Safe Password</STRONG></P>

<h3>Secure Password Selection</h3>


<!-- CONTENT STARTS HERE -->


The importance of picking a good, secure password can't be emphasized enough. Your password is the way the computer verifies that someone logging in is really you, so pick something that cannot be guessed by others. The top reasons people gain unauthorized acesses to a password protected system is: They guessed someone's password. (often because they found it on a piece of paper next to the victim's computer or because they saw the person type the password in, but also because they use software programs that are VERY good at guessing common passwords.)

<p>

<b>What Happens To People Who Choose Weak Passwords</b><BR>

If someone else obtains your passwords, they may start to use your account to see your private data, including email, your bank accounts, your phone messages; they could start to alter or destroy your files or they could take over your computer; and they might even perform illegal activities in your name -- in such cases, it is difficult to find out who the culprit is and you might get under suspicion.

<p>

<P>

<b>The Basics</b><BR>

The following guidelines will guard against someone finding out your password and using your account illegally:

<ol>

<li> Make your password as <b>long as possible</b>. The longer it is, the more difficult it will be to attack the password with a brute-force search. Always use at least 6 characters in your password, at least two of which are numeric.



<li><b>Use as many different characters as possible</b> when forming your password.  Use numbers, punctuation characters and, when possible, mixed upper and lower-case letters. Choosing characters from the largest possible alphabet will make your password more secure.



<li><b>Do not use personal information</b> in your password that someone else is likely to be able to figure out. Obviously, things like your name, phone number, and address are to be avoided.  Even names of acquaintances and the like should not be used.



<li>Do not use words, geographical names, or biographical names that are <b>listed in standard dictionaries</b>.



<li>Never use a password that is <b>the same as your account number</b>.



<li>Do not use passwords that are <b>easy to spot while you're typing them in</b>.  Passwords like 12345, qwerty (i.e., all keys right next to each other), or nnnnnn should be avoided.

</ol>

<p>


<b> Try This If You're Having Difficulty Selecting a <i>Good</i> Password</b></br>

If you are having difficulty picking a good password, <b class=hl>one good method is to use the first letter of each word in a phrase you can easily remember</b>.  For example, "Alta is my kind of place" would be Aimkop. Another method is to intentionally use misspelled words, or words with a number or punctuation mark suffixed. Examples include: braekfast, kite276, and weather. (the period at the end is part of the password). Also, many hackers use numbers or punctuation instead of letters to do a basic encrypt of text, as in: h3llo is hello or he!!o is also hello. Don't copy any of these examples, but y0u g3t the d4ift!  The more creative you are the better.

<p>

Here are some guidelines about what secure passwords should <strong>not</strong> include<sup>1</sup>:



<ul>

<li>Your name

<li>Your spouse's name

<li>Your parent's name

<li>Your pet's name

<li>Your child's name

<li>Names of close friends or coworkers

<li>Names of your favorite fantasy characters

<li>Your boss's name

<li>Anybody's name

<li>The name of the operating system you're using

<li>The hostname of your computer

<li>Your phone number

<li>Your license plate number

<li>Any part of your social security number

<li>Anybody's birth date

<li>Other information that is easily obtained about you

<li>Words such as wizard, guru, gandalf, and so on.

<li>Any username on the computer in any form (as is, capitalized, etc.)

<li>A word in the English dictionary

<li>A word in a foreign dictionary

<li>A place

<li>A proper noun

<li>Passwords of all the same letter

<li>Simple patterns on the keyboard, like qwerty

<li>Any of the above spelled backwards

<li>Any of the above followed or prepended by a single digit

</ul>



Good passwords<sup>2</sup>:

<ul>

<li>Have both upper and lower case letters

<li>Have digits and/or punctuation characters as well as letters

<li>Are easy to remember, so they do not have to be written down

<li>Are seven or eight characters long

<li>Can be typed quickly, so someone else cannot look over your shoulder

</ul>



<p>



<b>Advanced Password Strategies</b><br>
Changing passwords -- some people say that changing your password every 30 days is a good rule-of-thumb, and you should never go longer than 90 days before picking a new password. Other's disagree<sup>3</sup>. The longer you wait before changing passwords, the more difficult it will be to get used to the new one. Whatever you do, do not reuse any previous password you have used and do not write a password on a sticky piece of paper and put it near your computer. Also, please note that if someone cracks your GPG, PGP or SSH private key file password and makes a copy of your keyring, then you can change your GPG password all you want and they'll still be able to decrypt their copy of your keyring with the old password. So in the case of GPG, you should set your public key to expire and change your public key (I set mine to change every year) in addition to changing your password. 

<p>

This guy has the most <a href="http://world.std.com/~reinhold/diceware.html">excellent password selection strategy</a> that I have seen.



<blockquote class=callout>

<b>About This Page</b><br>

If people learn to pick better passwords, then computers are more secure for everyone. I intend on providing continued maintainanance to this page. Please let me know if anything on this page is misleading or needs updating or additions.

<p>

eric@wolfram.org

<p>

Please feel free to link to this page so that others can find it. It's easy to link to this page, just <b class=hl>copy the text below onto your web page</b>:

<p>

<small>&#60;a href="http://wolfram.org/writing/howto/password.html"&#62;How to pick a good password&#60;/a&#62;</small>

</blockquote>



<hr>

<p> [1] Simson Garfinkel and Gene Spafford, <cite>Practical UNIX Security</cite> (Sebastopol, CA: O'Reilly & Associates, Inc., 1991), pp. 33-34.



<p> [2] <cite>Ibid.</cite>, p. 35.



<p> [3] Tim McNerney sent me the following about changing passwords:

<p>

<small class=white>

Ran across your page http://wolfram.org/writing/howto/password.html and

have some disagreements with some of your recommendations. Well, really

just one. That one is changing your password frequently. It is my

belief that this leads to less, not more secure systems. Here's why.

<p>

Choosing a good password is difficult. You need it to be easy for a

user to remember, but hard for anyone else to guess. If it is difficult

for the user to remember, it will end up on a PostIt on his monitor. If

it is easy to guess, then many methods will work to compromise the

account.

<p>

Requiring a user to change his password on a regular basis means that

the user must come up with more passwords. The average quality of that

password will almost always be less than that of a single good

password. They are less likely to even try and come up with a good

password if they have to change it frequently. So the quality will

almost always be less.

<p>

The amount of time to crack a password using straight brute force

methods is almost always much greater than the expiration period. So

attempts to foil such an attempt with password expiration. There are

some cases where you need the information secured for a very long

period of time, but more often than not, this is not the case. In this

case changing your password once every ten years for a password space

that would take 100 years to brute force would be more than sufficient.

And the spaces we are talking about are much greater than that.

<p>

If a user's password is going to be broken, it will almost always

happen through means other than brute force. Either through the PostIt

method, social engineering, dictionary attacks, using personal

information. These attacks take much less time than you could

reasonable expire a password. Let's say you require changes every

month. The above attacks would take anywhere from a couple minutes to a

few hours. The compromise would happen on average with 15 days left

before the password would expire. Once compromised, there is little

(but not no) value in closing the barn door. Detecting and rectifying

these situations are better handled through other means, especially

since changing the password never let's anyone know that a compromise

ever occured, even though it stops it (though most likely, the person

will still have access through other means once they got in).

<p>

So basically, changing your password frequently doesn't prevent brute

force attacks in the general case, decreases the quality of passwords

used/increases the likelihood that they will get written down and while

mildly beneficial in that you cut off access to compromised systems,

does not help in detecting this nor do I believe the increased chance

of such an occurrence due to the previously mentioned problems is worth

the tradeoff.

<p>

I haven't really seen this theory mentioned anywhere else, so there may

be some obvious flaws I'm missing. And there are obviously certain

cases where it doesn't apply, but I think it is a good rule of thumb

for most people when choosing passwords. I'd appreciate any comments or

criticisms of my thoughts.

<p>

Also, I'd add a corollary to the last item in Good Passwords, which is

that a password should contain characters which alternate when typed

between the left and right hand. These tend to be quicker and easier to

type.

</small>



<!-- CONTENT ENDS HERE -->



<P>

<HR SIZE=1>

Other Wolfram <A HREF="/writing/howto/index.html">How To Articles</A> | <A HREF="/copyright.html">Notice of Copyright</A>



</BODY>

</HTML>

